blocks|key|2727562|text|几乎在你看到的任何地方，人们都会提到about:config和security.fileuri.strict_origin_policy。有时也包括network.http.refere.XOriginPolicy。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2727563|对我来说，这些似乎都没有任何效果。|2727564|This+comment暗示火狐没有内置的方式来实现这一点(截至2014年2月8日)。|offset|length|2727565|entityMap|0|LINK|mutability|MUTABLE|url|https://support.mozilla.org/en-US/questions/985841^0|0|0|0|C|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@$F|S|G|T|1|U]]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

Almost everywhere you look, people refer to the about:config and the security.fileuri.strict_origin_policy. Sometimes also the network.http.refere.XOriginPolicy.

For me, none of these seem to have any effect.

<a href="https://support.mozilla.org/en-US/questions/985841">This comment</a> implies there is no built-in way in Firefox to do this (as of 2/8/14).

blocks|key|2518017|text|在Firefox中，我知道了一个CORS+Everywhere+this扩展，它对我很有效。它创建MITM代理截取报头来禁用CORS。你可以在addons.mozilla.org或here上找到这个扩展。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2518018|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/29096229/1373333|1|https://addons.mozilla.org/en-US/firefox/addon/cors-everywhere/|2|http://spenibus.net/files/gitbin/cors-everywhere-firefox-addon/^0|W|4|0|1Z|I|1|2I|4|2|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]|$A|T|B|U|1|V]|$A|W|B|X|1|Y]]|C|$]]|$1|D|3|-4|5|6|7|Z|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]|N|$5|G|H|I|C|$J|O]]]]

From <a href="https://stackoverflow.com/a/29096229/1373333">this</a> answer I've known a CORS Everywhere Firefox extension and it works for me. It creates MITM proxy intercepting headers to disable CORS.
You can find the extension at <a href="https://addons.mozilla.org/en-US/firefox/addon/cors-everywhere/" rel="noreferrer">addons.mozilla.org</a> or <a href="http://spenibus.net/files/gitbin/cors-everywhere-firefox-addon/" rel="noreferrer">here</a>.

blocks|key|2727642|text|查看我的插件，它可以与最新的火狐版本一起使用，具有漂亮的UI并支持JS+regex：https://addons.mozilla.org/en-US/firefox/addon/cross-domain-cors|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2727643|更新:我刚刚为这个https://chrome.google.com/webstore/detail/cross-domain-cors/mjhpgnbimicffchbodmgfnemoghjakai添加了Chrome扩展|2727644|📷|atomic|2727645|​|2727646|entityMap|0|LINK|mutability|MUTABLE|url|https://addons.mozilla.org/en-US/firefox/addon/cross-domain-cors|1|https://chrome.google.com/webstore/detail/cross-domain-cors/mjhpgnbimicffchbodmgfnemoghjakai|2|IMAGE|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/cf8d35139b6d6136a23e45c6edde3400.png|imageAlt^0|16|1S|0|0|9|2K|1|0|0|1|2|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|D|3|E|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]]|C|$]]|$1|F|3|G|5|H|7|18|8|@]|9|@$A|19|B|1A|1|1B]]|C|$]]|$1|I|3|J|5|6|7|1C|8|@]|9|@]|C|$]]|$1|K|3|-4|5|6|7|1D|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]|S|$5|N|O|P|C|$Q|T]]|U|$5|V|O|W|C|$X|Y|Z|-4]]]]

Check out my addon that works with the latest Firefox version, with beautiful UI and support JS regex: <a href="https://addons.mozilla.org/en-US/firefox/addon/cross-domain-cors" rel="noreferrer">https://addons.mozilla.org/en-US/firefox/addon/cross-domain-cors</a>
 Update: I just add Chrome extension for this <a href="https://chrome.google.com/webstore/detail/cross-domain-cors/mjhpgnbimicffchbodmgfnemoghjakai" rel="noreferrer">https://chrome.google.com/webstore/detail/cross-domain-cors/mjhpgnbimicffchbodmgfnemoghjakai</a>
 
 
<a href="https://i.stack.imgur.com/fU2fa.png" rel="noreferrer"><img src="https://i.stack.imgur.com/fU2fa.png" alt="enter image description here"></a>

blocks|key|2518003|text|您提到的Chrome设置是关闭同源策略。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2518004|这在这个帖子中也有涉及：Disable+firefox+same+origin+policy|offset|length|2518005|关于:config+->+security.fileuri.strict_origin_policy+->+false|2518006|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/17088609/disable-firefox-same-origin-policy^0|0|C|Y|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@$D|R|E|S|1|T]]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

The Chrome setting you refer to is to disable the same origin policy.

This was covered in this thread also:
<a href="https://stackoverflow.com/questions/17088609/disable-firefox-same-origin-policy">Disable firefox same origin policy</a>

about:config -> security.fileuri.strict_origin_policy -> false

blocks|key|44361|text|2016年9月禁用CORS的最佳火狐插件：https://github.com/fredericlb/Force-CORS/releases|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|44362|你甚至可以通过推荐人(网站)来配置它。|44363|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/fredericlb/Force-CORS/releases^0|7|D|L|1D|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@$9|S|A|T|1|U]]|E|$]]|$1|F|3|G|5|6|7|V|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|W|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]]]

Best Firefox Addon to disable CORS as of September 2016: <a href="https://github.com/fredericlb/Force-CORS/releases" rel="nofollow">https://github.com/fredericlb/Force-CORS/releases</a>

You can even configure it by Referrers (Website).

blocks|key|2518198|text|我还没有找到与--disable-web-security等同的Firefox选项，也找不到一个能帮我做到这一点的插件。在一些无法修改web服务器的测试场景中，我真的需要它。真正有帮助的是使用Fiddler自动修改web响应，以便它们具有正确的报头和CORS不再是问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2518199|具体步骤如下：|2518200|2518201|开放式小提琴手。|ordered-list-item|2518202|2518203|如果在https上，请转到菜单工具->+Options+->+Https并勾选Capture+&+Decrypt+options|2518204|2518205|转到菜单rules+->+Customize+Rules。修改OnBeforeResponseFunction，使其如下所示，然后保存：|2518206|2518207|静态函数会话(oSession:OnBeforeResponse){+//....oSession.oResponse.headers.Remove("Access-Control-Allow-Origin")；oSession.oResponse.headers.Add("Access-Control-Allow-Origin"，"*")；//...+}|2518208|这将使每个web响应具有Access-Control-Allow-Origin：*标头。|2518209|2518210|这仍然不起作用，因为选项印前检查将通过并导致请求在上面的规则有机会修改标头之前阻塞。因此，为了解决这个问题，在fiddler主窗口的右侧有一个AutoResponder选项卡。添加新的规则和响应:+METHOD:OPTIONS+requests+with+auto+response：*CORSPreflightAllow并勾选框："Enable+Rules“和"Unmatched+requests+passthrough".|2518211|”|2518212|参考图片如下：|2518213|​|2518214|📷|atomic|offset|length|2518215|2518216|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/753c9259f02d3a45679ab3f0f9c54212.png|imageAlt^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|1|0|0|0^^$0|@$1|2|3|4|5|6|7|1G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1H|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|1I|8|@]|9|@]|A|$]]|$1|E|3|F|5|G|7|1J|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|1K|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|1L|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|1M|8|@]|9|@]|A|$]]|$1|L|3|M|5|G|7|1N|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|1O|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1P|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1Q|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|1R|8|@]|9|@]|A|$]]|$1|T|3|U|5|G|7|1S|8|@]|9|@]|A|$]]|$1|V|3|W|5|6|7|1T|8|@]|9|@]|A|$]]|$1|X|3|Y|5|6|7|1U|8|@]|9|@]|A|$]]|$1|Z|3|10|5|6|7|1V|8|@]|9|@]|A|$]]|$1|11|3|12|5|13|7|1W|8|@]|9|@$14|1X|15|1Y|1|1Z]]|A|$]]|$1|16|3|10|5|6|7|20|8|@]|9|@]|A|$]]|$1|17|3|-4|5|6|7|21|8|@]|9|@]|A|$]]]|18|$19|$5|1A|1B|1C|A|$1D|1E|1F|-4]]]]

I have not been able to find a Firefox option equivalent of --disable-web-security or an addon that does that for me. I really needed it for some testing scenarios where modifying the web server was not possible.
What did help was to use Fiddler to auto-modify web responses so that they have the correct headers and CORS is no longer an issue.
The steps are:
<ol>
<li>Open fiddler.
</li>
<li>If on https go to menu Tools -&gt; Options -&gt; Https and tick the Capture &amp; Decrypt https options
</li>
<li>Go to menu Rules -&gt; Customize rules. Modify the OnBeforeResponseFunction so that it looks like the following, then save:
<pre><code> static function OnBeforeResponse(oSession: Session) {
 //....
 oSession.oResponse.headers.Remove(&quot;Access-Control-Allow-Origin&quot;);
 oSession.oResponse.headers.Add(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
 //...
 }
</code></pre>
This will make every web response to have the Access-Control-Allow-Origin: * header.
</li>
<li>This still won't work as the OPTIONS preflight will pass through and cause the request to block before our above rule gets the chance to modify the headers.
So to fix this, in the fiddler main window, on the right hand side there's an AutoResponder tab.
Add a new rule and response:
METHOD:OPTIONS <a href="https://yoursite.com/" rel="nofollow noreferrer">https://yoursite.com/</a> with auto response: *CORSPreflightAllow
and tick the boxes: &quot;Enable Rules&quot; and &quot;Unmatched requests passthrough&quot;.
</li>
</ol>
See picture below for reference:
<a href="https://i.stack.imgur.com/l6o4M.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/l6o4M.png" alt="enter image description here" /></a>

blocks|key|43086|text|虽然问题提到了Chrome和Firefox，但还有其他软件没有跨域安全性。我提到它是为了那些忽视这种软件存在的人。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|43087|例如，PhantomJS是一个浏览器自动化引擎，它支持跨域安全停用。|43088|phantomjs.exe+--web-security=no+script.js|code-block|syntax|javascript|43089|请看我的另一个评论：Userscript+to+bypass+same-origin+policy+for+accessing+nested+iframes|offset|length|43090|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/45702427/userscript-to-bypass-same-origin-policy-for-accessing-nested-iframes/46608781#46608781^0|0|0|0|A|1W|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|X|8|@]|9|@$K|Y|L|Z|1|10]]|A|$]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]]]

While the question mentions Chrome and Firefox, there are other software without cross domain security. I mention it for people who ignore that such software exists.

For example, PhantomJS is an engine for browser automation, it supports cross domain security deactivation.

<pre><code>phantomjs.exe --web-security=no script.js
</code></pre>

See this other comment of mine: <a href="https://stackoverflow.com/questions/45702427/userscript-to-bypass-same-origin-policy-for-accessing-nested-iframes/46608781#46608781">Userscript to bypass same-origin policy for accessing nested iframes</a>

blocks|key|43308|text|对于在使用Nightwatch.js+(1.3.4)时发现这个问题的任何人，配置文件中都有一个acceptInsecureCerts:+true设置：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|43309|​|43310|firefox:+{
++++++desiredCapabilities:+{
++++++++browserName:+'firefox',
++++++++alwaysMatch:+{
++++++++++//+Enable+this+if+you+encounter+unexpected+SSL+certificate+errors+in+Firefox
++++++++++acceptInsecureCerts:+true,
++++++++++'moz:firefoxOptions':+{
++++++++++++args:+[
++++++++++++++//+'-headless',
++++++++++++++//+'-verbose'
++++++++++++],
++++++++++}
++++++++}
++++++}
++++},|code-block|syntax|javascript|43311|43312|entityMap^0|1B|P|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|S|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|T|8|@]|D|@]|E|$K|L]]|$1|M|3|G|5|6|7|U|8|@]|D|@]|E|$]]|$1|N|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|O|$]]

For anyone finding this question while using Nightwatch.js (1.3.4), there's an <code>acceptInsecureCerts: true</code> setting in the config file:

<div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
<div class="snippet-code">
<pre class="snippet-code-js lang-js prettyprint-override"><code>firefox: {
 desiredCapabilities: {
 browserName: 'firefox',
 alwaysMatch: {
 // Enable this if you encounter unexpected SSL certificate errors in Firefox
 acceptInsecureCerts: true,
 'moz:firefoxOptions': {
 args: [
 // '-headless',
 // '-verbose'
 ],
 }
 }
 }
 },</code></pre>
</div>
</div>

In Firefox, how do I do the equivalent of <code>--disable-web-security</code> in Chrome. This has been posted a lot, but never a true answer. Most are links to add-ons (some of which don't work in the latest Firefox or don't work at all) and "you just need to enable support on the server".

<ol>
<li>This is temporary to test. I know the security implications.</li>
<li>I can't turn on CORS on the server and I especially would never be able to allow localhost or similar.</li>
<li>A flag, or setting, or something would be a lot better than a plugin. I also tried: <a href="http://www-jo.se/f.pfleger/forcecors">http://www-jo.se/f.pfleger/forcecors</a>, but something must be wrong since my requests come back as completely empty, but same requests in Chrome come back fine.</li>
</ol>

Again, this is only for testing before pushing to prod which, then, would be on an allowable domain.

Disable cross domain web security in Firefox

在火狐中，我如何做与Chrome中的--disable-web-security相当的功能？这篇文章已经发布了很多次，但从来没有一个真正的答案。大多数都是指向附加组件的链接(其中一些在最新的Firefox中不起作用，或者根本不起作用)和“你只需要在服务器上启用支持”。这是暂时的测试。我知道安全implications.I不能打开服务器上的CORS，特别是我永远不能允许本地主机或类似的东西。一个标志

问在Firefox中禁用跨域web安全
EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Firefox中禁用跨域web安全EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Firefox中禁用跨域web安全
EN